Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libcurl: Restrict redirect schemes #4094

Closed
wants to merge 3 commits into from
Closed

libcurl: Restrict redirect schemes #4094

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d885a67
libcurl: Restrict redirect schemes
linosgian Jul 5, 2019
bcfc759
libcurl: Add testcase for gopher redirects
linosgian Jul 10, 2019
b45f7bf
fixup! libcurl: Restrict redirect schemes
linosgian Jul 10, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 2 additions & 3 deletions lib/url.c
View file
Open in desktop
Expand Up @@ -488,9 +488,8 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
define since we internally only use the lower 16 bits for the passed
in bitmask to not conflict with the private bits */
set->allowed_protocols = CURLPROTO_ALL;
set->redir_protocols = CURLPROTO_ALL & /* All except FILE, SCP and SMB */
~(CURLPROTO_FILE | CURLPROTO_SCP | CURLPROTO_SMB |
CURLPROTO_SMBS);
set->redir_protocols = CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_FTP
| CURLPROTO_FTPS;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since no browser ever supported FTPS and since most FTPS services actually will require FTP + upgrade, I think we can leave out FTPS as well and only allow HTTP, HTTPS and FTP by default.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, I've pushed a fixup reflecting your comment

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since no browser ever supported FTPS and since most FTPS services actually will require FTP + upgrade, I think we can leave out FTPS as well and only allow HTTP, HTTPS and FTP by default.

A little late on this but I disagree. curl allowed it and for all we know some server is redirecting to sftp or ftps for file transfer.


#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
/*
Expand Down